feat(json): record cliVersion, scannedAt and the effective options in the --json payload #1296

The --json payload records nothing about how it was produced, so a JSON file on its own cannot be traced back to a version or an invocation.

What happened

An adopter shared a scan JSON on 2026-10-07 and asked about three diagnostics in it. Working out which release produced it took four separate runs against 1.29.0, 1.30.0, 1.37.0 and current main, and the flags were never recoverable from the file at all. The answer turned out to matter: two of the three diagnostics only appear with --check-overrides, which their CI workflow does not pass, so the file came from a different invocation than the one we were shown.

The gap

report.json already carries scannedAt and cliVersion. The --json payload carries neither. That is the same --json versus report.json drift #1176 set out to remove, and both now come from src/output/scan-json.ts, so the fix belongs in one place.

What to add

Three things, at the top level of the --json payload:

• cliVersion - the running CLI version, read the same way report.json reads it
• scannedAt - an ISO timestamp, same as report.json
• the effective options for the run, not the raw command line (see below)

Record effective options, not process.argv

Effective options are more useful, because they capture defaults as well as what was typed, which is what you need to reproduce a run.

They are also safer, and this issue is the evidence: adopters share these files. --offline-db, --cache-dir and --osv-url can carry internal paths and internal registry or mirror hostnames, and raw argv would copy them verbatim into an artifact that gets uploaded to CI and emailed around. Emit the normalised boolean and enum options, and for any option whose value is a path or URL, record that it was set rather than what it was set to.

Success criterion

A --json run produces cliVersion, scannedAt and the effective options. Two runs differing only in --check-overrides produce payloads that differ in that field. No option value containing a filesystem path or a URL appears anywhere in the payload. Removing any of the three fields fails a test.

--json output is consumed by adopters' pipelines, so these are additive fields only; nothing existing changes shape.